关于Facebook后端API返回的for(;;);包裹JSON格式的技术问询

Great question—this is a clever little trick Facebook’s engineers came up with, and I’ll break down exactly why they do it, using your sample response as a reference:

1. Blocking JSON Hijacking Attacks #

The biggest reason is to defend against JSON hijacking, a security vulnerability that was more prevalent in earlier browser eras, but still a risk Facebook wanted to eliminate entirely.

Here’s how the attack would work without the wrapper: if a site returned raw JSON (like {"name": "Joe Dirt"}), a malicious actor could create a page that uses a <script> tag to load that API endpoint. Browsers execute <script> content as JavaScript, and since JSON object literals are valid JS syntax, attackers could use tricks like overriding array constructors to steal sensitive data from the response.

By prefixing the JSON with for (;;);, the response becomes invalid JavaScript if loaded directly via a <script> tag. That infinite loop would just hang the script execution, so attackers can’t parse or exfiltrate the JSON data. For Facebook’s own frontend code though? They simply strip that prefix before parsing the JSON like normal.

2. Consistent Parsing in Their Codebase #

Facebook’s frontend expects this specific format, so they’ve built utility functions to handle the wrapper automatically. A simplified version of how their code might process the response looks like this:

function processFacebookApiResponse(responseText) {
  // Strip off the infinite loop prefix
  const cleanJsonString = responseText.replace(/^for\s*\(\s*;;\s*\);/, '');
  // Parse the remaining valid JSON
  return JSON.parse(cleanJsonString);
}

Let’s Walk Through Your Sample #

Take the response you found:

for (;;);{ "__ar": 1, "payload": { "profiles": { "1244780025": { "id": "1355891136", "name": "JoeD Dirt", "firstName": "Joe", "vanity": "joe.dirt", "thumbSrc": "https://some.picture.url/source.png", "uri": "htt..." } } } }

After stripping the for (;;); part, you’re left with perfectly valid JSON that Facebook’s code can parse into a usable JavaScript object to render user profiles, posts, or whatever content the API is returning.

Bonus: Backward Compatibility #

This pattern dates back to a time when modern security standards like CORS (Cross-Origin Resource Sharing) weren’t universally adopted. Even though browsers have better built-in protections now, Facebook has kept the wrapper to avoid breaking their existing code that’s been built around this format for years.

内容的提问来源于stack exchange，提问作者Derek Pollard